diff --git a/.github/workflows/build_pr_preview.yml b/.github/workflows/build_pr_preview.yml
index 301a53a62d..4315a0f2a1 100644
--- a/.github/workflows/build_pr_preview.yml
+++ b/.github/workflows/build_pr_preview.yml
@@ -8,8 +8,7 @@ on:
     # Run when label is added or present and when pushing to the PR
     types: [labeled, opened, synchronize]
 
-permissions:
-  contents: write
+permissions: read-all
 
 jobs:
   build_preview: